Let's ignore the issue of integrity and look at confidentiality: • Browsers will reuse the same TCP connection when downloading multiple resources. Does apt no

Let's ignore the issue of integrity and look at confidentiality: • Browsers will reuse the same TCP connection when downloading multiple resources. Does apt not do this? This seems like it would make inferring package versions and names difficult. • Is it impractical to standardize on a fixed block size that works for most packages, and just add noise as required to 'top up' the size of the payload to match the same size as all the others? I found these articles interesting: • https://tools.ietf.org/html/draft-pironti-tls-length-hiding-01 https://tools.ietf.org/html/draft-pironti-tls-length-hiding-... • https://hal.inria.fr/hal-00732449/document https://hal.inria.fr/hal-00732449/document Also, is there an actual PoC for any of these size-related side channel attacks? I'd take it all a lot more seriously if there was one.